====== syzkaller ======

WARNING:  this is just an unsorted collection of notes currently.

===== Are there any public syzkaller instances? =====

  - [[https://syzkaller.appspot.com/freebsd|syzbot]]  ([[https://groups.google.com/forum/#!forum/syzkaller-freebsd-bugs|crash report mailing list]])
  - %%<%%more private ones run by some>

===== How to manually run a Syz repro? =====

  - install a few packages: go, gcc, gmake, and whatever comes along with it
  - run ''%%go get -u github.com/google/syzkaller%%''
  - ''%%cd ~/go/src/github.com/google/syzkaller%%''
  - ''%%gmake%%''
  - Once the build finished successfully:
  - ''%%bin/freebsd_amd64%%''
  - put the %%%%Syz repro%%%% output into a file (I call it ''%%x%%'').
  - ''%%./syz-execprog x%%''
    * you may want to play with  -procs %%<%%n> -repeat %%<%%n|0> -stdout -debug
    * also note the head of the %%%%Syz repro%%%% output has options encoded already

===== How do I add a new system call? =====

  - pkg install llvm, to get clang-format
  - add a description of the system call to sys/freebsd/*.txt (start a new file if appropriate, e.g., capsicum.txt for Capsicum-related system calls)
  - from the root of the syzkaller source tree, run ''%%gmake extract SOURCEDIR=/usr/src%%''
  - recreate automatically generated syscall definition files: ''%%gmake generate%%''
  - rebuild syzkaller: ''%%gmake%%''

Step 1 may be non-trivial depending on the complexity of the system call interface in question.  The syzkaller repo contains some pages describing the syscall description language: [[https://github.com/google/syzkaller/blob/master/docs/syscall_descriptions.md|1]], [[https://github.com/google/syzkaller/blob/master/docs/syscall_descriptions_syntax.md|2]].

===== netdump =====

<code>
echo 'dumpdev="NO"' >> /etc/rc.conf
</code>

<code>
# cat /etc/dhclient-exit-hooks

if [ "$reason" = BOUND ] || \
   [ "$reason" = REBOOT ] || \
   [ -z "$old_ip_address" ] || \
   [ "$old_ip_address" != "$new_ip_address" ]; then
        dumpon -s 169.254.0.1 -c $new_ip_address $interface
fi
</code>